<!DOCTYPE html>
<html lang="zh-CN">
<head>
<script src="https://cdn.jsdelivr.net/npm/jquery/dist/jquery.min.js"></script>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/font-awesome/css/font-awesome.min.css"> 
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.4.0">
  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">


<link rel="stylesheet" href="/lib/font-awesome/css/font-awesome.min.css">

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"georgeguoxv.gitee.io","root":"/","scheme":"Muse","version":"7.8.0","exturl":false,"sidebar":{"position":"left","Muse | Mist":220,"display":"post","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":false,"show_result":false,"style":null},"back2top":{"enable":true,"sidebar":false,"scrollpercent":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":false,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}}};
  </script>

  <meta name="description" content="windows本地调试器常用的调试器有很多，基本上所有编程语言的IDE都会带有调试的功能，python的pycharm, jupyter notebook, java的 eclipse，intelliJ, c++的visual studio Windows本地调试器（以Windbg为例）不同于编程语言的调试，Windbg调试的对象是一个程序所调用的windows操作系统的API，例如使用USER3">
<meta property="og:type" content="article">
<meta property="og:title" content="windows调试器的使用，汇编语言逆向开发">
<meta property="og:url" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/index.html">
<meta property="og:site_name" content="George的博客">
<meta property="og:description" content="windows本地调试器常用的调试器有很多，基本上所有编程语言的IDE都会带有调试的功能，python的pycharm, jupyter notebook, java的 eclipse，intelliJ, c++的visual studio Windows本地调试器（以Windbg为例）不同于编程语言的调试，Windbg调试的对象是一个程序所调用的windows操作系统的API，例如使用USER3">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506182723494.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507133202708.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507134844407.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135115012.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135225209.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135912353.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135951315.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507140327790.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507140906143.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506194832735.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506195438059.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506195830487.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506203455919.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506201331646.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506210806807.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506212217272.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506214749046.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506214907259.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506215213881.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506220714399.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506220601087.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506221428836.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507141812249.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506222215890.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507142703483.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507145439018.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507145601653.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507145752578.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507151056017.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507152408184.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507152618881.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507153059775.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506201907881.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162213449.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162411091.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162911296.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162958471.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507164307350.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507164222087.png">
<meta property="og:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507172250461.png">
<meta property="article:published_time" content="2021-05-05T16:17:12.000Z">
<meta property="article:modified_time" content="2021-05-07T10:52:52.915Z">
<meta property="article:author" content="George Guo">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506182723494.png">

<link rel="canonical" href="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>windows调试器的使用，汇编语言逆向开发 | George的博客</title>
  
    <script async src="https://www.googletagmanager.com/gtag/js?id=G-K1BDW9XHBV"></script>
    <script>
      if (CONFIG.hostname === location.hostname) {
        window.dataLayer = window.dataLayer || [];
        function gtag(){dataLayer.push(arguments);}
        gtag('js', new Date());
        gtag('config', 'G-K1BDW9XHBV');
      }
    </script>


  <script>
    var _hmt = _hmt || [];
    (function() {
      var hm = document.createElement("script");
      hm.src = "https://hm.baidu.com/hm.js?ec3fe06eb0228c5b6ef8635fb259b905";
      var s = document.getElementsByTagName("script")[0];
      s.parentNode.insertBefore(hm, s);
    })();
  </script>




  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

</head>

<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">George的博客</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
      <p class="site-subtitle" itemprop="description">学习使我快乐</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="menu">
        <li class="menu-item menu-item-home">

    <a href="/" rel="section"><i class="fa fa-fw fa-home"></i>首页</a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/archives/" rel="section"><i class="fa fa-fw fa-archive"></i>归档</a>

  </li>
  </ul>
</nav>




</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="https://georgeguoxv.gitee.io/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/images/favicon-32x32.png">
      <meta itemprop="name" content="George Guo">
      <meta itemprop="description" content="本博客为纯静态网站">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="George的博客">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          windows调试器的使用，汇编语言逆向开发
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              <time title="创建时间：2021-05-06 00:17:12" itemprop="dateCreated datePublished" datetime="2021-05-06T00:17:12+08:00">2021-05-06</time>
            </span>
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2021-05-07 18:52:52" itemprop="dateModified" datetime="2021-05-07T18:52:52+08:00">2021-05-07</time>
              </span>

          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <h2 id="windows本地调试器"><a href="#windows本地调试器" class="headerlink" title="windows本地调试器"></a>windows本地调试器</h2><p>常用的调试器有很多，基本上所有编程语言的IDE都会带有调试的功能，python的pycharm, jupyter notebook, java的 eclipse，intelliJ, c++的visual studio</p>
<p>Windows本地调试器（以Windbg为例）不同于编程语言的调试，Windbg调试的对象是一个程序所调用的windows操作系统的API，例如使用USER32!CreateWindowExA创建窗口和使用ws2_32.dll来访问网络</p>
<p>接下来，结合编程语言的调试（源码调试）和操作系统API的调试，就能对项目进行深入的研究</p>
<p>即便是在没有源码的情况下，windows本地调试也能给我们一些线索，帮助逆向开发</p>
<h2 id="大佬的Github源码"><a href="#大佬的Github源码" class="headerlink" title="大佬的Github源码"></a>大佬的Github源码</h2><p><a target="_blank" rel="noopener" href="https://github.com/chengciming/wechatPc">https://github.com/chengciming/wechatPc</a></p>
<p>下载源码，我们就可以开始了  </p>
<p>国内可以使用gitee，一些github加速网站，以及一些github镜像网站  </p>
<p>不想自己下载可以加群 <code>147694968</code> 求助源码</p>
<p>将wechatPc-master.rar文件下载到本地后，解压到当前文件夹</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506182723494.png" alt></p>
<p>wechatRobot目录内是执行注入操作的wechatRobot.exe的项目源码</p>
<p>wechatdll目录内是需要被注入的wechatdll.dll的项目源码</p>
<p>Bin目录是这两个项目的成品输出目录</p>
<h2 id="步骤-视频演示"><a href="#步骤-视频演示" class="headerlink" title="步骤+视频演示"></a>步骤+视频演示</h2><h3 id="大佬的github上给出了项目的通信机制"><a href="#大佬的github上给出了项目的通信机制" class="headerlink" title="大佬的github上给出了项目的通信机制"></a>大佬的github上给出了项目的通信机制</h3><p>通讯流程：WechatDll(注入到微信) &lt;—&gt; [WS] &lt;—&gt; WechatRobot(操作界面) &lt;—&gt; [WS] &lt;—&gt; ServerPhp(服务端) &lt;—&gt; [WS] &lt;—&gt; Web(HTML操作界面)</p>
<p>我们以此流程来进行</p>
<h3 id="步骤0-开启微信2-8-0-121"><a href="#步骤0-开启微信2-8-0-121" class="headerlink" title="步骤0 开启微信2.8.0.121"></a>步骤0 开启微信2.8.0.121</h3><p>如图</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507133202708.png" alt="image-20210507133202708"></p>
<p>如果你打开2.8.0.121被要求强制升级，先将微信安装的文件夹备份到别的地方，再升级当前微信。升级后卸载新版本微信，将旧版本复制回来。（这个方法仅供参考）</p>
<p>这时我们打开 procexp.exe ，没有的话到微软官方网站下载sysinternals工具包</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507134844407.png" alt="image-20210507134844407">点击那个准星，拖到打开的微信的窗口上，它就自动帮我们定位到了进程，可以看到进程ID是11368</p>
<p>接下来打开windbg</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135115012.png" alt="image-20210507135115012">点击file，attach to a process, 在弹窗的ProcessID输入刚刚找到的ID<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135225209.png" alt="image-20210507135225209"></p>
<p>点击OK之后，你会发现微信的窗口怎么点都没反应，这是因为这个进程已经被windbg暂停了，如果你的windbg设置好了符号，你就可以看到windbg自动识别出来了微信进程所调用的所有dll模块，设置符号的方法如图所示：<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135912353.png" alt="image-20210507135912353"><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507135951315.png" alt="image-20210507135951315"></p>
<p>可以按照我的格式设置</p>
<p>之后输入命令<code>.reload</code> 重新加载符号，再输入<code>x wechatwin!*</code>，这个命令能列出wechatwin.dll里的所有函数</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507140327790.png" alt="image-20210507140327790"></p>
<p>我们甚至可以看到有一个叫<code>StartWachat</code>的函数</p>
<p>输入命令<code>lmDvmWeChatwin</code>，我们可以看到公司名字是腾讯<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507140906143.png" alt="image-20210507140906143"></p>
<p>输入<code>lmDvmWeChatdll</code>，会发现什么都没有，这是因为我们还没有注入我们的wechatdll.dll</p>
<h3 id="步骤1-开启php服务端和web端"><a href="#步骤1-开启php服务端和web端" class="headerlink" title="步骤1 开启php服务端和web端"></a>步骤1 开启php服务端和web端</h3><p>首先介绍这个项目的结构和功能，这个项目的根本功能是：在web端（web目录下的index.html）里我们的所有操作都能转化成微信exe进程的操作。</p>
<p>每当我们在web端点击新开一个微信并且登录进去，php服务端（相当于一个ws服务器）以及hook端（wechatRobot.exe）就将这个微信账号和一个微信的exe进程相联系起来。具体的实现方法是将web端发送的ws（websocket， 不懂请看我关于websocket的文章）操作指令包转发给微信exe进程，从而实现在web端控制exe。</p>
<p>php服务端会一直检测当前的web进程以及wechatrobot.exe进程,将所有web端的操作和消息转发给wechatrobot.exe,wechatrobot.exe验证web端身份后将消息发给对应的微信exe</p>
<p>首先开启php服务端，需要装有compser的php环境，要么自己安装composer,要么下载作者github的vender目录。 进入ServerPhp目录，运行index.php   (进入ServerPhp文件夹，按住shift右键空白处，选择在此处打开powershell)</p>
<p>进入powershell后，输入命令<code>../phpbin/php.exe index.php</code>,（如果你自己安裝了php环境，就可以使用<code>php index.php</code>）开启后如图</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506194832735.png" alt="image-20210506194832735">此时php已经开始监听web端和hook端了，hook端将消息传到8686端口，php就能收到，php同样可以从8686发送消息给hook端</p>
<p>这时我们打开Web目录里的index.html，会看到<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506195438059.png" alt="image-20210506195438059">服务端已经发现了这个web端，并赋予这个web端id为1</p>
<p>这时我们在web端点击绿色微信图标，点击新开一个<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506195830487.png" alt="image-20210506195830487">红色的提示意思是没有发现在线的微信，这是因为我们还没有将hook端连接到服务器</p>
<span id="more"></span>
<h3 id="步骤2-hook端连接web端"><a href="#步骤2-hook端连接web端" class="headerlink" title="步骤2 hook端连接web端"></a>步骤2 hook端连接web端</h3><p>打开hook端（Bin/Debug或Release目录下的wechatRobot.exe）,为了更清楚的了解wechatRobot.exe的作用，我们不仅要打开，还要调试这个程序。这就需要我们在Visual Studio中，打开WechatRobot目录里的wechatRobot.sln</p>
<p>我们可以看到wechatrobot.cpp里开启了两个线程，一个是连接微信exe的ws，一个是连接web服务端的ws，按住ctrl点击WebSocketMonitor,我们就能进入到这个函数<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506203455919.png" alt="image-20210506203455919">可以看到，这个函数又调用了一个叫WsServerint()的函数，我们再ctrl+左键点进去</p>
<p>看到这里又调用了一个叫WsServerListen的函数，我们同样点进去</p>
<p>这时就看到这里有一个对ws的监听函数，鼠标放在这个常量上，就知道了这个程序所使用的端口是6789</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506201331646.png" alt="image-20210506201331646"></p>
<p>接着打开WechatService.cpp,找到InjectDll函数,下断点。</p>
<p>接着按住ctrl+shift+f，或者在右上方搜索find in file，搜索clientconnect，接着回车，直到找到这个初始化连接服务端的函数，同样下断点<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506210806807.png" alt>现在我们运行程序，确保选择Debug x86模式。</p>
<p>大约五秒后程序会断在上边的断点，按f11进入函数，再按f10一直到 第110行，这时我们再按一次，php上就会跳出<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506212217272.png" alt="image-20210506212217272">可以看到php接受了id为2的微信</p>
<p>这时wechatrobot.exe已经连上了php，我们再进入web端点击新开一个</p>
<p>不过在此之前，再网页里按f12打开开发者工具，点击如图所示</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506214749046.png" alt="image-20210506214749046">之后会弹出搜索框，在搜索框输入如图所示<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506214907259.png" alt="image-20210506214907259"></p>
<p>点击找到的函数 send(msg)，同样在296行下断点</p>
<p>这时回到页面，此时页面已经触发断点<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506215213881.png" alt="image-20210506215213881">这时点击控制台（console），输入ws，我们就可以看到现在ws变量的值，如图<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506220714399.png" alt="image-20210506220714399">我们看到这条ws消息发送到到本机的5678端口，那么我们打开资源监视器，</p>
<p>点击网络，点击侦听端口，我们看到php监听了5678端口，那么如果我们继续发送，php一定能收到</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506220601087.png" alt="image-20210506220601087"></p>
<p>点击开发者工具的继续，我们看到php跳出一条消息<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506221428836.png" alt="image-20210506221428836"></p>
<p>我试了好几次，都弹出这条消息。这是为什么呢？回到VS一看，原来我们的wechatrobot.exe还在调试暂停状态，刚刚运行完 第110行 如图</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507141812249.png" alt="image-20210507141812249"></p>
<p>我们直接继续让wechatRobot运行起来，就可以看到 transit wechat message：（意思就是：中转来自wechat的消息），仔细观察这一大串日志，<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506222215890.png" alt="image-20210506222215890">我们发现<code>&quot;timestamp&quot;:&quot;1620368375566&quot;,&quot;wechatId&quot;:null,&quot;opCode&quot;:0</code>，这里的timestamp是unix时间戳，opcode代表的操作码在 opCode.h 中，如下图：，我们只需要注意wechatid，这里的 null 代表没有<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507142703483.png" alt="image-20210507142703483"></p>
<p>也就是说我们还没有将wechatRobot.exe和微信exe进程连接起来，这时我们需要再次点击新开一个，不过在此之前，先找到下图下断点<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507145439018.png" alt="image-20210507145439018">之后我们点击新开一个，断点就断在这个位置，我们在Locals找data的值，找不到的话如图：<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507145601653.png" alt="image-20210507145601653">点击放大镜查看，我们发现一个wechatid发送了操作指令16。<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507145752578.png" alt="image-20210507145752578"></p>
<p>还记得指令16是什么吗？十进制的16就是十六进制的10，也就是新开一个微信客户端命令<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507151056017.png" alt="image-20210507151056017">也就是说，WeChatRobot成功接收到web端的指令了</p>
<h2 id="步骤3-hook端连接微信exe程序"><a href="#步骤3-hook端连接微信exe程序" class="headerlink" title="步骤3 hook端连接微信exe程序"></a>步骤3 hook端连接微信exe程序</h2><p>继续执行wechatRobot，我们又遇到一个断点，是我们最开始在InjectDLL下的断点，我们可以看到这里hook端启动了一个新的微信exe</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507152408184.png" alt="image-20210507152408184">这时我们看一下locals里 pi.dwProcessId的值为11488，还记得我们的微信PID是11368<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507152618881.png" alt="image-20210507152618881">所以这里我们需要双击Value栏，把dwProcessID改成11368，也就是让hook端hook正在运行的微信exe，而不是如图（11488的微信exe）<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507153059775.png" alt="image-20210507153059775">修改后，再次运行wechatRobot。这时就已经将dll注入到了PID11368微信exe，这个dll会不停的监控微信exe的活动并转发给WechatRobot</p>
<p>我们的微信还在windbg中暂停状态，在windbg中输入<code>qd</code>命令，就会退出debug但保留exe进程</p>
<p>在我们<code>qd</code>之前，先在图示WebsocketListen.cpp文件中ctrl+F搜索关键词”接收“，这就是WechatRobot处理dll转发来的数据的函数，我们在第254行下断点!<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210506201907881.png"> </p>
<p>在<code>qd</code>的一瞬间，微信就已经运行了起来，同时VS的断点就触发了，这时因为我们注入的dll运行起来了，并且转发了一条消息到wechatRobot，我们先不管VS，我们再次打开windbg，附加到进程11368，可以看到加载符号的最后一行就已经有了我们注入的wechatDll<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162213449.png" alt="image-20210507162213449"></p>
<p>确认dll加载后，我们回到VS，看到断点 第254行，autos或locals里的data变量的值如图右所示</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162411091.png" alt="image-20210507162411091">我们查看一下操作指令144，打开计算器选择十进制，输入144后点十六进制，如图得到90</p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162911296.png" alt="image-20210507162911296"></p>
<p><img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507162958471.png" alt="image-20210507162958471"></p>
<p>找到对应的操作码后我们发现这是把二维码发送给web端，接着我们按F11进入WsServerRecvCallback函数，再按F10一句一句一直运行到第90行，<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507164307350.png" alt="image-20210507164307350">然后点击command window，输入<code>? (char *)json</code>回车<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507164222087.png" alt="image-20210507164222087"></p>
<p>然后F10，就会发现php直接就接收到了一模一样的消息，而且在二维码在web端也已经显示了出来。如果你在websocket.js 第356行 下了断点，你会发现这是因为网页端收到了php转发来的二维码消息，<img src="/2021/05/06/windows%E8%B0%83%E8%AF%95%E5%99%A8%E7%9A%84%E4%BD%BF%E7%94%A8%EF%BC%8C%E6%B1%87%E7%BC%96%E8%AF%AD%E8%A8%80%E9%80%86%E5%90%91%E5%BC%80%E5%8F%91/image-20210507172250461.png" alt="image-20210507172250461"></p>
<p>现在我们已经实现了从微信exe到web端的消息通信，现在只需要在VS里继续运行wechatRobt，在windbg里继续运行微信exe程序，所有作者项目里实现的功能就都能够使用了，<a target="_blank" rel="noopener" href="https://github.com/chengciming/wechatPc/blob/master/WechatDll/WechatDll/WechatOffset.h">已实现hook的功能</a></p>
<h2 id="直接从Web端操作的另一种方法"><a href="#直接从Web端操作的另一种方法" class="headerlink" title="直接从Web端操作的另一种方法"></a>直接从Web端操作的另一种方法</h2><details><summary>视频演示</summary><video id="video" controls preload="none">
    <source id="mp4" src type="video/mp4">
</video></details>








    </div>

    
    
    
        <div class="reward-container">
  <div></div>
  <button onclick="var qr = document.getElementById('qr'); qr.style.display = (qr.style.display === 'none') ? 'block' : 'none';">
    打赏
  </button>
  <div id="qr" style="display: none;">
      
      <div style="display: inline-block;">
        <img src="/images/%E5%BE%AE%E4%BF%A1.png" alt="George Guo 微信支付">
        <p>微信支付</p>
      </div>
      
      <div style="display: inline-block;">
        <img src="/images/%E6%94%AF%E4%BB%98%E5%AE%9D.png" alt="George Guo 支付宝">
        <p>支付宝</p>
      </div>

  </div>
</div>


      <footer class="post-footer">

        


        
    <div class="post-nav">
      <div class="post-nav-item">
    <a href="/2021/04/24/PC%E5%BE%AE%E4%BF%A1hook%E9%80%86%E5%90%91%EF%BC%8C%E4%BA%8C%E6%AC%A1%E5%BC%80%E5%8F%91/" rel="prev" title="PC微信hook逆向，二次开发">
      <i class="fa fa-chevron-left"></i> PC微信hook逆向，二次开发
    </a></div>
      <div class="post-nav-item"></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          
  <div class="comments" id="comments">
    
       
       <div id="gitment-container"></div>
       
    
  </div>

  

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">
<iframe frameborder="no" border="0" marginwidth="0" marginheight="0" width=330 height=230 src="//music.163.com/outchain/player?type=0&id=401771073&auto=1&height=430"></iframe>

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#windows%E6%9C%AC%E5%9C%B0%E8%B0%83%E8%AF%95%E5%99%A8"><span class="nav-number">1.</span> <span class="nav-text">windows本地调试器</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%A4%A7%E4%BD%AC%E7%9A%84Github%E6%BA%90%E7%A0%81"><span class="nav-number">2.</span> <span class="nav-text">大佬的Github源码</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E6%AD%A5%E9%AA%A4-%E8%A7%86%E9%A2%91%E6%BC%94%E7%A4%BA"><span class="nav-number">3.</span> <span class="nav-text">步骤+视频演示</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%A4%A7%E4%BD%AC%E7%9A%84github%E4%B8%8A%E7%BB%99%E5%87%BA%E4%BA%86%E9%A1%B9%E7%9B%AE%E7%9A%84%E9%80%9A%E4%BF%A1%E6%9C%BA%E5%88%B6"><span class="nav-number">3.1.</span> <span class="nav-text">大佬的github上给出了项目的通信机制</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%AD%A5%E9%AA%A40-%E5%BC%80%E5%90%AF%E5%BE%AE%E4%BF%A12-8-0-121"><span class="nav-number">3.2.</span> <span class="nav-text">步骤0 开启微信2.8.0.121</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%AD%A5%E9%AA%A41-%E5%BC%80%E5%90%AFphp%E6%9C%8D%E5%8A%A1%E7%AB%AF%E5%92%8Cweb%E7%AB%AF"><span class="nav-number">3.3.</span> <span class="nav-text">步骤1 开启php服务端和web端</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%AD%A5%E9%AA%A42-hook%E7%AB%AF%E8%BF%9E%E6%8E%A5web%E7%AB%AF"><span class="nav-number">3.4.</span> <span class="nav-text">步骤2 hook端连接web端</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E6%AD%A5%E9%AA%A43-hook%E7%AB%AF%E8%BF%9E%E6%8E%A5%E5%BE%AE%E4%BF%A1exe%E7%A8%8B%E5%BA%8F"><span class="nav-number">4.</span> <span class="nav-text">步骤3 hook端连接微信exe程序</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E7%9B%B4%E6%8E%A5%E4%BB%8EWeb%E7%AB%AF%E6%93%8D%E4%BD%9C%E7%9A%84%E5%8F%A6%E4%B8%80%E7%A7%8D%E6%96%B9%E6%B3%95"><span class="nav-number">5.</span> <span class="nav-text">直接从Web端操作的另一种方法</span></a></li></ol></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="George Guo"
      src="/images/favicon-32x32.png">
  <p class="site-author-name" itemprop="name">George Guo</p>
  <div class="site-description" itemprop="description">本博客为纯静态网站</div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">8</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
  </nav>
</div>
  <div class="links-of-author motion-element">
      <span class="links-of-author-item">
        <a href="https://github.com/George-Guo-tech" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;George-Guo-tech" rel="noopener" target="_blank"><i class="fa fa-fw fa-github"></i>GitHub</a>
      </span>
      <span class="links-of-author-item">
        <a href="https://gitee.com/GeorgeGuoXv" title="Gitee → https:&#x2F;&#x2F;gitee.com&#x2F;GeorgeGuoXv" rel="noopener" target="_blank"><i class="fa fa-fw fa-custom gitee"></i>Gitee</a>
      </span>
      <span class="links-of-author-item">
        <a href="https://m.bilibili.com/space/553832852" title="Bilibili → https:&#x2F;&#x2F;m.bilibili.com&#x2F;space&#x2F;553832852" rel="noopener" target="_blank"><i class="fa fa-fw fa-custom bilibili"></i>Bilibili</a>
      </span>
  </div>


  <div class="links-of-blogroll motion-element">
    <div class="links-of-blogroll-title">
      <i class="fa fa-fw fa-link"></i>
      友情链接
    </div>
    <ul class="links-of-blogroll-list">
        <li class="links-of-blogroll-item">
          <a href="https://github.com/chengciming/wechatPc" title="https:&#x2F;&#x2F;github.com&#x2F;chengciming&#x2F;wechatPc" rel="noopener" target="_blank">微信机器人项目(C++,php,html5)</a>
        </li>
        <li class="links-of-blogroll-item">
          <a href="https://github.com/cspinstructor/my-crackmes" title="https:&#x2F;&#x2F;github.com&#x2F;cspinstructor&#x2F;my-crackmes" rel="noopener" target="_blank">C++逆向练习</a>
        </li>
    </ul>
  </div>

      </div>

    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
<script src="/live2d/autoload.js"></script>
<script type="text/javascript" src="https://cdn.jsdelivr.net/gh/Justlovesmile/CDN/js/sakura.js"></script>
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/gitalk@1/dist/gitalk.css">
  <script src="https://cdn.jsdelivr.net/npm/gitalk@1/dist/gitalk.min.js"></script><script src="/js/src/md5.min.js"></script>

<div id="gitalk-container"></div>
<script>

const gitalk = new Gitalk({
  clientID: '52d4fe3261227490009f',
  clientSecret: 'abf5c09c8aeb14f4bcbf49b9fc838aef6ef9bc14',
  repo: 'George-Guo-tech.github.io',      // The repository of store comments,
  owner: 'George-Guo-tech',
  admin: ['George-Guo-tech'],
  id: md5(location.pathname),      // Ensure uniqueness and length less than 50
  distractionFreeMode: false  // Facebook-like distraction free mode
})

gitalk.render('gitalk-container')
//   var gitment = new Gitment({
//   id: 'www.bibibigeorge.site',
//   owner: 'George-Guo-tech',
//   repo: 'George-Guo-tech.github.io',
//   oauth: {
//     client_id: '52d4fe3261227490009f',
//     client_secret: 'abf5c09c8aeb14f4bcbf49b9fc838aef6ef9bc14',
//   },
//   // ...
//   // For more available options, check out the documentation below
// })
//   // gitment.render('container')
//   gitment.render(document.getElementById('comments'))


jQuery(document).ready(function() {
    function c() {
        /* 排除首页（记得自行修改下首页地址） */
	if (location.href != "https://bibibigeorge.site") { document.title = document[a] ? "(つェ⊂)誒呀→《" + d + "》" : "(*´∇｀*) 咦好了→《" + d + "》" }
    }
    var a, b, d = document.title;
    "undefined" != typeof document.hidden ? (a = "hidden", b = "visibilitychange") : "undefined" != typeof document.mozHidden ? (a = "mozHidden", b = "mozvisibilitychange") : "undefined" != typeof document.webkitHidden && (a = "webkitHidden", b = "webkitvisibilitychange");
    "undefined" == typeof document.addEventListener && "undefined" == typeof document[a] || document.addEventListener(b, c, !1)
});
</script>

	<script type="text/javascript" src="/js/src/clicklove.js"></script>
	  <!-- <script src="https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js"></script> -->
      <div class="footer-inner">
        

        

<div class="copyright">
  
  &copy; 
  <span itemprop="copyrightYear">2023</span>
  <span class="with-love">
    <i class="fa fa-user"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">George Guo</span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io/" class="theme-link" rel="noopener" target="_blank">Hexo</a> & <a href="https://muse.theme-next.org/" class="theme-link" rel="noopener" target="_blank">NexT.Muse</a> 强力驱动
  </div>
  <div class="addthis_inline_share_toolbox">
    <script src="//s7.addthis.com/js/300/addthis_widget.js#pubid=ra-6059e3bca1c1bc91" async="async"></script>
  </div>
<script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js">
</script>
<span id="busuanzi_container_site_pv">
| 本站总访问量<span style="color:#FA8072" id="busuanzi_value_site_pv"></span>次
</span>
<span id="busuanzi_container_site_uv">
| 本站访客数<span style="color:#FA8072" id="busuanzi_value_site_uv"></span>人次
</span>





        








      </div>
    </footer>
  </div>

  
  <script src="/lib/anime.min.js"></script>
  <script src="/lib/velocity/velocity.min.js"></script>
  <script src="/lib/velocity/velocity.ui.min.js"></script>

<script src="/js/utils.js"></script>

<script src="/js/motion.js"></script>


<script src="/js/schemes/muse.js"></script>


<script src="/js/next-boot.js"></script>




  
  <script>
    (function(){
      var bp = document.createElement('script');
      var curProtocol = window.location.protocol.split(':')[0];
      bp.src = (curProtocol === 'https') ? 'https://zz.bdstatic.com/linksubmit/push.js' : 'http://push.zhanzhang.baidu.com/push.js';
      var s = document.getElementsByTagName("script")[0];
      s.parentNode.insertBefore(bp, s);
    })();
  </script>

















  

  

  

  
</body>
</html>
